mirror of
https://github.com/oqyude/nixos.git
synced 2026-10-07 20:47:14 +03:00
76 lines
2.2 KiB
Nix
76 lines
2.2 KiB
Nix
{
|
|
config,
|
|
inputs,
|
|
pkgs,
|
|
...
|
|
}:
|
|
# VDS nginx differs from server's in one key way: port 443 is owned
|
|
# by an nginx stream block that does SNI-based TCP routing, not by
|
|
# http { server {} } blocks. This lets a single host (pubray1.zeroq.su)
|
|
# serve both the 3x-ui panel and an Xray REALITY inbound over TLS,
|
|
# sharing the same port.
|
|
#
|
|
# Routing:
|
|
# pubray1.zeroq.su → 127.0.0.1:2049 (3x-ui panel; LE cert mounted
|
|
# into the container terminates TLS)
|
|
# pubrayx1.zeroq.su → 127.0.0.1:15380 (Xray REALITY; Xray sees its
|
|
# real configured port 443 via DNAT)
|
|
# default → 127.0.0.1:15380 (REALITY fallback for any
|
|
# other SNI / IP-direct)
|
|
#
|
|
# ssl_preread reads SNI from the ClientHello and forwards the rest of
|
|
# the TLS stream as-is, so Xray sees a real port-443 connection even
|
|
# though podman DNATs it via host:15380.
|
|
let
|
|
# Goes inside the auto-generated `stream {}` block (services.nginx.streamConfig).
|
|
# pubray1.zeroq.su → 3x-ui panel; everything else (including any SNI
|
|
# a REALITY client uses, e.g. media.mediavitrina.ru) → Xray.
|
|
streamConfig = ''
|
|
ssl_preread on;
|
|
|
|
map $ssl_preread_server_name $sni_backend {
|
|
default xray;
|
|
pubray1.zeroq.su panel;
|
|
}
|
|
|
|
upstream panel {
|
|
server 127.0.0.1:2049;
|
|
}
|
|
|
|
upstream xray {
|
|
server 127.0.0.1:15380;
|
|
}
|
|
|
|
server {
|
|
listen 443;
|
|
proxy_pass $sni_backend;
|
|
proxy_timeout 600s;
|
|
proxy_connect_timeout 5s;
|
|
}
|
|
'';
|
|
in
|
|
{
|
|
users.users.nginx.extraGroups = [ "acme" ];
|
|
services.nginx = {
|
|
enable = true;
|
|
recommendedGzipSettings = true;
|
|
recommendedOptimisation = true;
|
|
recommendedProxySettings = true;
|
|
recommendedTlsSettings = true;
|
|
# ACME only — 443 is owned by the stream block, not by http { server {} }.
|
|
# Don't add forceSSL: it would generate an HTTPS server block that
|
|
# conflicts with the stream listener.
|
|
virtualHosts."pubray1.zeroq.su".enableACME = true;
|
|
# Lands inside the auto-generated `stream {}` block.
|
|
streamConfig = streamConfig;
|
|
};
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
defaults.email = "oqyude@gmail.com";
|
|
};
|
|
networking.firewall.allowedTCPPorts = [
|
|
80
|
|
443
|
|
];
|
|
}
|